If you want group A to be able to access MAINFOLDER, and any subfolders they need in SUBFOLDER, but group B to access MAINFOLDER\SUB, change the permissions on SUB to only include permissions for group B, remove any and all permissions for all other groups. They will see the folder present in the directory, but if A or even C tried to click on it, permission denied. Only B would successfully enter the folder to see its contents.
The beauty of permissions, is you can literally have an infinite number of different security groups, and then assign those groups as you need. For example 10 people all belong to the Accounting group, 5 of those people are also in the Fees group, 5 of them are in the Costs group. You have an Accounting folder, containing a Fees folder and a Costs folder. All people in the Accounting dept have Accounting access so they can see the contents of the folder, but you have now added only Fees access to Fees and Costs to Costs, if a Fees member tries to click on Costs. Denied. You can scale this to any number of people, departments and folders and get very granular all the way down to single people. Course when you get that granular, usually you are talking about home folders and startup scripts to map a drive to said folder, but thats a different ball of wax.
